Insufficient validation of untrusted input in the Downloads section of Google Chrome on macOS allowed a local attacker to potentially execute a sandbox escape using a crafted AppleScript command. The flaw is an input validation weakness (CWE‑20) and specifically an instance of insufficient validation of untrusted input (CWE‑1286), enabling the attacker to run code with higher privileges than the browser sandbox permits and potentially compromise system confidentiality or integrity.

All macOS installations of Google Chrome with versions prior to 149.0.7827.53 are vulnerable. Any user running an affected Chrome version on a Mac desktop is potentially exposed.

The CVSS score is 8.6, indicating high severity. The EPSS score of < 1%, a very low but non‑zero exploitation probability, shows that the vulnerability is unlikely to be widely abused, and it is not listed in CISA’s KEV catalog; therefore the public exploitation probability remains low, but the local nature of the vector reduces the attack surface to users with access to the machine. The Chromium severity is Medium, reflecting the potential for privilege escalation when an attacker controls AppleScript execution. Attackers would need local access and the ability to run AppleScript, which is typically granted by the user to trusted applications. No public exploit has been reported as of now.